[auth failed]
log 1 pass = Dec 19 06:21:06 ny dovecot: imap-login: Disconnected (auth failed, 7 attempts in 111 secs): user=<thousands>, method=PLAIN, rip=109.201.200.201, lip=67.205.141.203, session=<+hgd5vxDBMZtycjJ>
log 2 pass = Jan 11 03:45:09 hostname dovecot: auth-worker(default): sql(username,1.2.3.4): unknown user
log 3 pass = Jan 11 03:42:09 hostname dovecot: auth(default): pam(user@example.com,1.2.3.4): pam_authenticate() failed: User not known to the underlying authentication module

rule = 9705
alert = 5
decoder = dovecot

[dovecot is starting]
log 1 pass = Jun 17 10:15:24 hostname dovecot: Dovecot v1.2.rc3 starting up (core dumps disabled)

rule = 9703
alert = 3
decoder = dovecot

[fatal error]
log 1 pass = Jun 17 10:15:24 hostname dovecot: Fatal: auth(default): Support not compiled in for passdb driver 'ldap'
log 2 pass = Jun 17 10:15:24 hostname dovecot: Fatal: Auth process died too early - shutting down

rule = 9704
alert = 2
decoder = dovecot

[user authentication failure]
log 1 pass = Jun 23 15:04:05 Info: imap-login: Login: user=<username>, method=PLAIN, rip=1.2.3.4, lip=1.2.3.5 Authentication Failure:

rule = 9770
alert = 0
decoder = dovecot-info

[dovecot auth failed]
log 1 pass = Jan 11 03:42:09 hostname dovecot: auth-worker(default): sql(user@example.com,1.2.3.4): Password mismatch

rule = 9702
alert = 5
decoder = dovecot

[XXX nothing]
log 1 fail = Jan 07 14:46:28 Warn: auth(default): userdb(username,::ffff:127.0.0.1): user not found from userdb
log 3 fail = May 31 09:43:57 Info: pop3-login: Aborted login (1 authentication attempts): user=<username>, method=PLAIN, rip=::ffff:1.2.3.4, lip=::ffff:1.2.3.5, secured

rule = 1002
alert = 2
decoder =

[XXX unknown 1002]
log 1 pass = Mar 13 15:25:07 Info: auth(default): pam(user@example.com,::ffff:1.2.3.4): pam_authenticate() failed: User not known to the underlying authentication module

rule = 9771
alert = 5
decoder = dovecot-info

[session disconnected]
log 1 pass = Jul  4 17:30:51 hostname dovecot[2992]: pop3-login: Disconnected: rip=1.2.3.4, lip=1.2.3.5

rule = 9706
alert = 3
decoder = dovecot

[aborted login]
log 1 pass = Jan 30 09:37:55 hostname dovecot: pop3-login: Aborted login: user=<username>, method=PLAIN, rip=::ffff:1.2.3.4, lip=::ffff:1.2.3.5

rule = 9707
alert = 5
decoder = dovecot

[XXX logged out]
log 1 fail = Jun 23 15:04:06 Info: IMAP(username): Disconnected: Logged out bytes=59/566

rule = 1002
alert = 2
decoder = dovecot-info

[unknown user]
log 1 pass = Mar 13 15:25:07 Info: auth(default): passwd-file(user@example.com,::ffff:1.2.3.4): unknown user

rule = 9771
alert = 5
decoder = dovecot-info